# Cascade Adversarial Machine Learning Regularized with a Unified Embedding

arXiv: https://arxiv.org/abs/1708.02582 · HTML: https://mlsanity.com/paper/1708.02582/

## Key facts

- Cited by 13 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 8 Aug 2017.

## Built on by (most cited first, 13 of 13)

- [Biometrics: Trust, but Verify](https://mlsanity.com/paper/2105.06625/) (2021)
- [Towards Trustworthy and Aligned Machine Learning: A Data-centric Survey with Causality Perspectives](https://mlsanity.com/paper/2307.16851/) (2023)
- [Anti-Retroactive Interference for Lifelong Learning](https://mlsanity.com/paper/2208.12967/) (2022)
- [Resilient Machine Learning for Networked Cyber Physical Systems: A Survey for Machine Learning Security to Securing Machine Learning for CPS](https://mlsanity.com/paper/2102.07244/) (2021)
- [The art of defense: letting networks fool the attacker](https://mlsanity.com/paper/2104.02963/) (2021)
- [Perturbation Inactivation Based Adversarial Defense for Face Recognition](https://mlsanity.com/paper/2207.06035/) (2022)
- [Artificial Immune System of Secure Face Recognition Against Adversarial Attacks](https://mlsanity.com/paper/2406.18144/) (2024)
- [Faithful Knowledge Distillation](https://mlsanity.com/paper/2306.04431/) (2023)
- [Mitigating Gradient-based Adversarial Attacks via Denoising and Compression](https://mlsanity.com/paper/2104.01494/) (2021)
- [Associative Adversarial Learning Based on Selective Attack](https://mlsanity.com/paper/2112.13989/) (2021)
- [A Perturbation Resistant Transformation and Classification System for Deep Neural Networks](https://mlsanity.com/paper/2208.11839/) (2022)
- [Scoring Black-Box Models for Adversarial Robustness](https://mlsanity.com/paper/2210.17140/) (2022)
- [On the Trade-Off Between Transparency and Security in Adversarial Machine Learning](https://mlsanity.com/paper/2511.11842/) (2025)

## Abstract (arXiv)

Injecting adversarial examples during training, known as adversarial training, can improve robustness against one-step attacks, but not for unknown iterative attacks. To address this challenge, we first show iteratively generated adversarial images easily transfer between networks trained with the same strategy. Inspired by this observation, we propose cascade adversarial training, which transfers the knowledge of the end results of adversarial training. We train a network from scratch by injecting iteratively generated adversarial images crafted from already defended networks in addition to one-step adversarial images from the network being trained. We also propose to utilize embedding space for both classification and low-level (pixel-level) similarity learning to ignore unknown pixel level perturbation. During training, we inject adversarial images without replacing their corresponding clean images and penalize the distance between the two embeddings (clean and adversarial). Experimental results show that cascade adversarial training together with our proposed low-level similarity learning efficiently enhances the robustness against iterative attacks, but at the expense of decreased robustness against one-step attacks. We show that combining those two techniques can also improve robustness under the worst case black box attack scenario.